Detections
Analytics

Cisco Integrated Management Controller Argument Injection (CVE-2026-20200) (cisco-sa-cimc-arg-inject-upSHdMfU)

high Nessus Plugin ID 334143

Synopsis

The remote device is missing a vendor-supplied security patch.

Description

According to its self-reported version, Cisco Integrated Management Controller is affected by a vulnerability.

 - A command injection vulnerability exists in the web-based management interface of Cisco Integrated Management Controller (IMC) due to improper validation of user-supplied input. An authenticated, remote attacker can exploit this, via entering crafted inputs to the web-based management interface, to execute arbitrary commands. (CVE-2026-20200)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

Solution

Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwt16342

See Also

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwt16342

http://www.nessus.org/u?e0b37d8c

Plugin Details

Severity: High

ID: 334143

File Name: cisco-sa-cimc-arg-inject-upSHdMfU_20200.nasl

Version: 1.1

Type: Combined

Family: CISCO

Published: 8/10/2026

Updated: 8/10/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.9

Percentile: 99.35

CVSS v2

Risk Factor: High

Base Score: 9

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-20200

CVSS v3

Risk Factor: High

Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/o:cisco:integrated_management_controller

Required KB Items: Host/Cisco/CIMC/version, Host/Cisco/CIMC/model

Patch Publication Date: 8/5/2026

Vulnerability Publication Date: 8/5/2026

Reference Information

CVE: CVE-2026-20200

CWE: 141, 146

CISCO-SA: cisco-sa-cimc-arg-inject-upSHdMfU

IAVA: 2026-A-0806

CISCO-BUG-ID: CSCwt16342